Sovereignty · Updated 10 November 2026 · 8 min read

What is Spain's ENS certification for cloud providers?

Who needs ENS, how the Basic, Medium and High categories work, how a provider gets certified and which clouds publish an ENS High certificate.

View as Markdown

ENS, the Esquema Nacional de Seguridad or National Security Framework, is Spain's mandatory security standard for the public sector, set by Royal Decree 311/2022. It also binds any private company, Spanish or foreign, whose systems deliver services to a Spanish public body under contract. If your app serves a Spanish ministry, region, town hall or university, you'll usually be asked for an ENS certificate at Medium or High level, and the cloud underneath must meet ENS too.

This guide summarises the decree and the official guidance of the CCN, Spain's National Cryptologic Centre. It isn't legal advice.

ENS at a glance

Question	Answer
Legal basis	Royal Decree 311/2022, in force since 5 May 2022, replacing Royal Decree 3/2010
Who runs it	The CCN publishes the guidance; ENAC, the Spanish accreditation body, accredits the certifiers
Who must comply	The whole Spanish public sector, and private providers whose systems serve it under contract
Levels	Three categories: Basic, Medium and High
How you prove it	Basic: a self-assessment and a Declaration of Conformity. Medium and High: an audit and a Certification of Conformity
How often	A security audit at least every two years, and again after substantial changes
Where to show it	The certificate is published on the website of the entity that holds it

Who has to comply

Article 2 of the decree applies ENS to the entire public sector. Article 2.3 extends it to the information systems of private companies that provide services or solutions to public bodies under a contract. Those companies need their own security policy, approved by their top executive body.

The decree also tells public buyers what to do: their tender documents must include the requirements needed to make the contractor's systems ENS conformant, such as presenting a Declaration or Certification of Conformity. That duty reaches the contractor's own supply chain as far as the risk analysis requires. So your hosting provider can be pulled into scope even if your contract is the only one with the public body.

Being a non-Spanish company doesn't exempt you. The CCN's FAQ answers a foreign company directly: its systems need the Certification of Conformity after passing the certification audit, just like a Spanish one.

Basic, Medium and High

The category depends on how much harm a security incident would cause, measured across five dimensions: availability, authenticity, integrity, confidentiality and traceability. The highest level reached in any one dimension sets the category for the whole system.

Category	When it applies	How conformity is shown
Basic	No dimension goes above low impact	Self-assessment and Declaration of Conformity; a certification audit is optional
Medium	At least one dimension reaches medium, none reaches high	Certification audit by an accredited body
High	At least one dimension reaches high, meaning very serious harm	Certification audit by an accredited body, with more measures

The owner of the information or service rates the impact, and the security officer sets the category. The rating must be reviewed every year or whenever the criteria change significantly.

What ENS says about cloud services

Annex II of the decree has a measure just for the cloud, called op.nub.1. It works on two sides.

If you sell a cloud service to the public sector, you must apply the set of measures for your service model, SaaS, PaaS or IaaS, defined in the CCN-STIC guides.
If your system runs on someone else's cloud, that cloud must be ENS conformant or meet a CCN-STIC guide covering penetration testing, transparency, encryption and key management, and the jurisdiction of the data.
At Medium and High, a reinforcement adds that third-party cloud services must be certified under a methodology recognised by Spain's IT security certification body.
At High, a second reinforcement requires the specific security configuration guides for the service.

So for a Medium or High system, expect the public body to ask about two layers: your own conformity and the certification of the cloud you run on. The CCN also publishes a specific compliance profile for cloud services, a reduced set of measures fitted to that sector.

How a provider gets certified

Decide the scope: which information systems serve the public sector.
Rate each dimension and set the category, following Annex I.
Apply the measures for that category from Annex II, using the CCN-STIC 800 series guides.
For Basic, run a self-assessment and sign a Declaration of Conformity. For Medium or High, hire a certification body.
The certifier audits the system and issues a Certification of Conformity, along with a conformity badge: a PDF it signs that links to the certification and must stay reachable from your website while it's valid.
Repeat the audit at least every two years, and after any substantial change to the system.

The CCN lists the certification bodies on its site. Private firms are accredited by ENAC under ISO/IEC 17065, and some regional and state agencies are recognised to audit public systems. A body still in the process of accreditation may audit and issue certificates for up to 12 months while it waits.

Systems that already existed when the decree took effect had 24 months to adapt, a window that closed on 5 May 2024.

Which cloud providers publish an ENS certificate

Provider	ENS level it states	Where to check
AWS	High, covering 31 regions including Spain	AWS ENS page and certificate
Microsoft Azure	High, for Azure, Microsoft 365 and Dynamics 365	Microsoft Learn ENS page
Google Cloud	High, for Google Cloud and Google Workspace	Google Cloud ENS page
OVHcloud	High-level conformity, in one line with no scope details	OVHcloud compliance page
Eurobase	None	Not applicable

Each provider's certificate covers named services, not everything it sells. AWS and Google both publish a list of services in scope, and AWS links CCN-STIC-887 guides written with the CCN for configuring its cloud to ENS. Check that every service your system uses appears on that list before you cite the certificate in a tender.

Where Eurobase stands

Eurobase has no ENS certificate, and it doesn't hold ISO 27001 or SOC 2 either: work on both is under way. If a Spanish public contract places your system at Medium or High, Eurobase can't meet the cloud measure for it, so run that system on a certified provider.

Eurobase suits the parts of your work that sit outside a public contract: marketing sites, internal tools, prototypes and apps for private customers that want European hosting. The company is registered in Warsaw, Poland, and your apps are hosted on European infrastructure run by Scaleway, a French provider. Pricing is flat per workspace: a Free plan, then €10 or €20 a month + VAT. Nothing is billed for usage today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving. Connecting GitHub or GitLab adds GitHub or GitLab Inc. as a US subprocessor. The host in the EU guide shows where each part runs, and hosting in Spain covers providers with Spanish data centres.

How ENS relates to other frameworks

ISO 27001: many ENS measures line up with it, and Microsoft's page notes the overlap, but an ISO certificate isn't an ENS certificate.
SecNumCloud: France's qualification adds ownership and operator rules that ENS doesn't have. See data residency vs data sovereignty.
NIS2 and DORA: EU laws on supplier security for regulated entities, covered in NIS2 and DORA for hosting.
Ownership: an ENS certificate doesn't tell you which country's laws apply to the company behind your cloud. Read EU region vs EU company for that question.

Frequently asked questions

Is ENS mandatory for private companies?

Only for systems that provide services or solutions to Spanish public bodies under a contract, and for their supply chain where the risk analysis calls for it. A company selling only to private customers isn't required to certify.

Can a non-Spanish cloud provider get ENS certified?

Yes. The CCN says any company, Spanish or not, can certify the systems it uses to serve Spanish public administrations, and AWS, Microsoft, Google and OVHcloud all state ENS High certification or conformity.

How long is an ENS certificate valid?

The decree requires a regular audit at least every two years, and an extra one after substantial changes. The date of an extraordinary audit restarts the two-year count, and the period can stretch by three months for force majeure.

What's the difference between ENS Medium and ENS High?

The category follows the worst-case harm of an incident. High applies when harm in any dimension would be very serious, such as wiping out an organisation's ability to function or causing irreparable damage. High adds more measures, including stricter cloud reinforcements.

Where can I check a provider's ENS certificate?

The decree requires holders to publish declarations and certifications on their website. AWS and Google link their certificates from their ENS pages, and Microsoft's page names the auditor, BDO. The CCN's ENS site lists the certification bodies, which helps you confirm that the auditor named on a certificate is accredited.